128 CERT Exercises Toolset Document for students

Transcription

1 128 CERT Exercises Toolset 14. Exercise: Proactive incident detection 14.1 What will you learn? In this exercise you will learn how to set up and work with AbuseHelper. AbuseHelper is an open source software designed to help CERT/CSIRT organisation with consolidating and using information feeds. You will learn how to install and configure all parts of the AbuseHelper toolset. You will learn how to take the application set into production. You will learn how to identify useful information and how to handle it Exercise tasks The instructor will give an introduction to the topic of information consolidation and background details to the development and technology used in AbuseHelper. Mandatory for this exercise is a working Internet connection, as the feeds will be pulled in from online sources. All necessary parts for running the application set are available on the Virtual Image (/usr/share/trainee/14_pid/). You will find helpful information in the documents in the References folder Task 1 Setting up AbuseHelper AbuseHelper. The instructor will provide you with the documentation on how to install Fill this table: Required XMPP user names XMPP user password Name of lobby room Output: botnet status /var/lib/ah2/production Have you received alert mails? Answer 1. Ejabber Daemon 18 The Ejabber Daemon is the communication channel for AbuseHelper. It is essential for the exchange of information between bots and users. The daemon has been installed from the Ubuntu repository but some basic configuration changes have to be applied. 18 Ejabberd Installation and Operation Guide

2 CERT Exercises Toolset 129 sudo /etc/init.d/ejabberd start # Start the Jabber service sudo ejabberdctl register abusehel localhost exercise # register a user for the bots (username host password) sudo ejabberdctl register trainee localhost exercise # register a user (username host password) sudo vi /etc/ejabberd/ejabberd.cfg # open the ejabberd configuration file and edit the following lines max_user_sessions 100 # maximum sessions for a single user s2s_default_policy deny # deny server to server communication %% {shaper, c2s_shaper},# search for and comment out the default shaper configuration Figure 1 : ejabberd.cfg shaper configuration {mod_muc, [ %%{host, "conference.@host@"}, {access, muc}, {access_create, muc}, {access_persistent, muc}, {access_admin, muc_admin}, {max_users_admin_threshold, 20}, # add this entry {max_user_conferences, 1000}, # add this entry {max_users, 500} Figure 2: ejabberd.cfg shaper configuration sudo /etc/init.d/ejabberd restart # Restart ejabberd server

3 130 CERT Exercises Toolset 2. AbuseHelper The next step will be to install the AbuseHelper applications and create the basic configuration. sudo useradd -m abusehel # add a system user for AbuseHelper sudo mkdir -p /var/lib/ah2 # create the working directory sudo chown root:abusehel /var/lib/ah2 # ownership of the working directory sudo chmod 0750 /var/lib/ah2 # directory access rights set to read, write cd /usr/share/trainee/14_pid/adds/abusehelper/ # change your current directory (trainee for the students) sudo python setup.py install # run the AbuseHelper setup script cd /usr/local/lib/python2.7/dist-packages/abusehelper # c`ange directory sudo python contrib/confgen/confgen.py /var/lib/ah2/production # start the configuration script Enter the following information: XMPP username: abusehel@localhost # as defined during user registration XMPP password: exercise # you will be asked to enter this twice XMPP lobby channel: abusehelper # this is the initial channel to connect to when starting the Jabber client Configure mailer? Yes # let AbuseHelper send alert mails SMTP host: localhost # use the local MTA for delivery SMTP port: 25 # use the standard SMTP port SMTP auth user: no auth # no authentication necessary Mail sender: abusehelper@localhost # mail sender address sudo chown -R root:abusehel /var/lib/ah2/production # access rights have to be corrected after the configuration script sudo chmod 0750 /var/lib/ah2/production # see above sudo chmod g+w /var/lib/ah2/production/archive # see above sudo chown abusehel /var/lib/ah2/production/log # this directory has been added and must be owned by the abusehel system user for logging sudo chown abusehel /var/lib/ah2/production/state # see above sudo vi /var/lib/ah2/production/startup.py # open the startup script and check the entries made by means of the confgen script Insert this line after service_room=service_room, in the def basic section: xmpp_ignore_cert = True, # this deactivates checking ssl certificates Comment out the following line in the def configs section:

4 CERT Exercises Toolset 131 # yield basic( roomgraph ) Figure 3: Startup.py Configure the mail recipient in the runtime.py file: sudo vi /var/lib/ah2/production/runtime.py Change the recipient from someone@example.com to trainee@localhost Figure 4: Runtime.py 3. Start AbuseHelper Now we are ready to start the AbuseHelper application along with the basic bots. sudo su - abusehel -s /bin/bash # change to the abusehel system user botnet start /var/lib/ah2/production # start the bots defined in the startup.py script botnet status /var/lib/ah2/production # ask for the status; at least one instance should be running

5 132 CERT Exercises Toolset botnet stop /var/lib/ah2/production # stop the AbuseHelper bots Logs can be found in these directories: /var/lib/ah2/production/log/ /var/log/ejabberd/ To enable logging functionality for every bot (logs can be found from /var/lib/ah2/production/log) uncomment the lines outlined below in Figure 5. Figure 5: Startup.py state and log configuration 4. Start Jabber clients Communication with AbuseHelper and gathering information from the bots is mainly done by means of Jabber clients. There are several Jabber clients installed on the VM; you should at least try the following ones. Psi+ A graphical client; you will have to trust the certificate presented by the Jabber service

6 CERT Exercises Toolset 133 manually. Figure 6: Psi+ initial configuration This screenshot (Figure 7) shows the service discovery feature: Figure 7: Psi+ service discovery Roomreader A command line client, this comes with AbuseHelper. roomreader --xmpp-ignore-cert trainee@localhost abusehelper

7 134 CERT Exercises Toolset Figure 8: Roomreader Task 2 Working with Abusehelper 1. Making yourself familiar with AbuseHelper The first step will be to watch the different subrooms and identify the information flow. The table at the end of this section helps to structure and evaluate the learning process. 2. Carry on and include additional data feeds In this task you should identify and describe the data feeds in the /usr/share/lib/python2.7/dist-packages/abusehelper/contrib section and document which to include. Afterwards you should configure the bots in the startup.py and runtime.py files (error messages will be logged to the bot files in the /var/lib/ah2/production/log/ folder). 3. Filter information feeds There are different ways to filter the incoming information to be more relevant to your organisation s infrastructure. Start with dshield and open the runtime.py. You will find an entry regarding the ASN. Change the Autonomous System Numbers (ASN) to your organisation s network(s). Edit runtime.py (/var/lib/ah2/production/runtime.py) to filter ASN numbers. A list linking ASN to organisations can be found here. The functionality of this filter mechanism is implemented in the dshield bot itself. Sanitisers take the raw data provided by the bots, clean it according to the configuration and deliver it to the abusehelper.sources room. Examples for sanitiser scripts are available in /var/lib/ah2/production/custom/. These can be easily adapted for other bots. These fields/tags can be used in rules. Create a sanitiser script for one of the bots from contribution and modify it to add the ENISA tag to the output. You can write rules to filter output. First, tweak the def _mail section in the runtime.py to use abusehelper.sources as data input. Then add a customer definition to send all data tagged with ENISA to trainee@localhost.

8 CERT Exercises Toolset 135 Fill the table with the requested information: Question N No. Which 1 feeds are standard? 1 What 2 information do these deliver? 2 Answer Where 3 are additional feed bots available? Integrate 4 the Arbor SSH bot startup.py: yield basic( arborssh, abusehelper.contrib.arbor.ssh ) runtime.py: yield source( arborssh ) Integrate 5 the sshlogbot startup.py: yield basic( sshlog, abusehelper.contrib.sshlogbot.sshogbot, path= /var/log/auth.log ) runtime.py: yield source( sshlog ) Integrate 6 the Team Cymru RSS feed startup.py: yield basic( cymrurss, abusehelper.contrib.rssbot.rssbt, feeds=

9 136 CERT Exercises Toolset cymru.org/news/secnews.rss ) runtime.py:yield source( cymru-rss ) Create 7 sanitiser scripts for the included bots (copy from existing abusech.sanitizer.py) Modify 8 one sanitiser to add tag=enisa to the output and send the corresponding report to localhost mailbox. Name 9 three bots you find most useful for your work and give reasons for your decision.

10 CERT Exercises Toolset Conclusion Finishing this exercise you will have learned how to perform the following actions: installation of Abusehelper; base configuration of AbuseHelper and default bots; evaluating and integrating bots from the contribution folder; filtering of input and output information with rules; accessing AbuseHelper information. The provided information should give you a starting point for the evaluation/implementation of AbuseHelper in your organisation.